How to Configure ISA Server to Audit Changes Made to Its Configuration Settings or to Its Policies (827818)

MORE INFORMATION

By default, ISA Server does not audit changes that are made to its configuration or to its policies. However, you can configure ISA Server to perform basic auditing of any such changes. When ISA Server audits these changes, an event is generated when a user creates, modifies, or removes an access rule, and an event message is logged in the security log. The event provides a user account name and records the time and the date when the policy change was made. To configure auditing, follow these steps:

Note Because there are several versions of Microsoft Windows, the following steps may be different on your computer. If they are, see your product documentation to complete these steps.

1. Turn on auditing on the server where ISA Server is installed. To do this, follow these steps:
   1. Click Start, point to Settings, click Control Panel, double-click Administrative Tools, and then double-click Local Security Policy.
   2. Expand Local Policies, and then click Audit Policy.
   3. In the details pane, double-click Audit object access.
   4. Select the Success check box, and then click OK.
   5. Quit Local Security Settings.
2. Configure a system access control list (SACL) on the ISA Server policy storage container. To do this, follow these steps:
   
   WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.
   1. Click Start, click Run, type regedt32 in the Open box, and then click OK.
   2. Click the following registry subkey:

      HKEY_CLASSES_ROOT\CLSID\{E205C653-0426-11D2-9A4D-0060081E9D26}\InprocServer32

   3. On the Security menu, click Permissions.
   4. Click Advanced, click the Auditing tab, and then click Add.
   5. Click the Everyone group, and then click OK.
   6. Under Successful, select the Query Value check box.
   7. Click OK, click OK, and then click OK.
   8. Quit Registry Editor.

After you configure the SACL, when a user creates, modifies, or removes an access rule, the following event messages appear in the security log.

Note The event descriptions differ depending on the policy modification that the user makes.

• When a user opens the policy storage container to modify a policy, the following event message appears:Event Source: Security
  Event Category: Object Access
  Event ID: 560
  Date: Date
  Time: Time
  Type: Success
  User: Example\UserName
  Computer: ServerName
  Description:
  Object Open:
  Object Server: Security
  Object Type: Key
  Object Name: : \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E205C653-0426-11D2-9A4D-0060081E9D26}\InprocServer32
  New Handle ID: 632
  Operation ID: {0,199050}
  Process ID: 1752
  Primary User Name: UserName
  Primary Domain: Example
  Primary Logon ID: (0x0,0x8FE1)
  Client User Name: -
  Client Domain: -
  Client Logon ID: -
  Accesses DELETE
  READ_CONTROL
  WRITE_DAC
  WRITE_OWNER
  Query key value
  Set key value
  Create sub-key
  Enumerate sub-keys
  Notify about changes to keys
  Create Link
  Privileges -
• When a user closes the policy storage container after changing a policy, the following event message appears:Event Source: Security
  Event Category: Object Access
  Event ID: 562
  Date: Date
  Time: Time
  Type: Success
  User: Example\UserName
  Computer: ServerName
  Description:
  Handle Closed:
  Object Server: Security
  Handle ID: 632
  Process ID: 1752

These two events are generated each time ISA Server writes to the access control policy. Because ISA Server writes to the policy in three different places for each user-defined access rule, six events appear in the security log when a change is made to the access control policy.